There's some truth to what you say but I don't think it's completely for insidious/non-meritocratic reasons.
I'm far along enough in my career that I can say that I think what's happening is that it's very very hard to hire somebody through the old "post job, take tons of resumes, filter, interview" method because there's so much crap, and so much noise, and so much risk of getting false positives and false negatives, etc., that eventually you realize it is much much easier and more reliable to hire people you've already worked with at a previous company in the past. You can vouch for them as a known quantity.
Ideally, a bigger proportion of hiring would happen like this. But there's always new folks entering the field who won't have somebody to vouch for them, plus, not everybody who you would vouch for is available or interested, so you sometimes to have to go the posting-resume-interview route and cross your fingers.
So it's almost the opposite of what you said, though with the same goal! You should want to hire based solely on merit -- but if you have to fill a job opening and your choice comes down to filling it with a total stranger whose resume claims he has 20 years of experience in "J2EE/JBOSS/Jscript" versus filling it with a guy you know firsthand had delivered a major threading-related fix to a previous employer's Java codebase the wiser and more meritocratic choice is probably to go with the second guy. And it's not because he knows a secret handshake. :)